This AI Almost WIPED Your Code

Key Takeaways

Another day, another example of AIS being used to hack. Amazon AI coding agent hacked to inject data wiping commands. This is from Bleeping Computer and they talk about how a hacker planted data wiping code in a version of Amazon's generative AI powered assistant, the Q developer extension for Visual Studio Code. So, this is supposedly there to help developers code, debug, create documentation, and set up custom configurations. It's available on Microsoft Visual Studio Codes Marketplace and counts nearly 1 million installs. As reported by 404 media, a hacker added unapproved code on Amazon's Q GitHub to inject a defective wiper that wouldn't cause any harm, but rather sent a message about AI coding security. The reason that it didn't cause any harm was because it was misconfigured. If that had been configured correctly, the damage may have been much worse. Amazon assured users that there was no risk because the malicious code was incorrectly formatted and wouldn't run on their environments. But can you imagine what would have happened if it had been correctly formatted?